morphcloud 0.1.111__tar.gz → 0.1.113__tar.gz

{morphcloud-0.1.111 → morphcloud-0.1.113}/.gitignore

@@ -19,6 +19,7 @@ wheels/
 *.egg-info/
 .installed.cfg
 *.egg
+.ruff_cache/
 
 # Poetry
 poetry.lock
@@ -60,3 +61,10 @@ _build/
 
 # uv
 uv.lock
+
+#clanker
+AGENTS.md
+CLAUDE.md
+PLAN.md
+.codex/
+.agents/

{morphcloud-0.1.111 → morphcloud-0.1.113}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: morphcloud
-Version: 0.1.111
+Version: 0.1.113
 Summary: A Python SDK and CLI tool for creating, managing, and interacting with Morph Cloud VMs.
 Author-email: Morph Labs <jobs@morph.so>
 License: Apache-2.0
@@ -216,6 +216,68 @@ morphcloud instance copy inst_123:/remote/file.log ./local_dir/
 morphcloud instance copy -r ./local_dir inst_123:/remote/dir
 ```
 
+### Plugins
+
+Plugins are Python packages that register extra `morphcloud` commands through
+the `morphcloud.cli_plugins` entry-point group. Catalog and package operations
+use your normal `MORPH_API_KEY`. A catalog entry can install from the private
+simple-index package name or from an explicit `artifact_url`.
+
+```bash
+# Inspect plugin configuration and installed commands
+morphcloud plugin doctor
+
+# List or inspect plugins visible to your organization
+morphcloud plugin list
+morphcloud plugin show intro
+
+# Validate install resolution without changing the environment
+morphcloud plugin install intro --dry-run
+
+# Install or update a plugin into the current Python environment
+morphcloud plugin install intro
+morphcloud plugin upgrade intro
+
+# Run the command exposed by the installed plugin
+morphcloud intro --help
+```
+
+Common commands:
+
+| Command | Purpose |
+| --- | --- |
+| `morphcloud plugin list [query]` | List visible enabled plugins. |
+| `morphcloud plugin search <query>` | Search visible plugins by name, package, artifact, or command. |
+| `morphcloud plugin show <name>` / `info` | Show one catalog entry. |
+| `morphcloud plugin install <name>` | Install into the active Python environment. |
+| `morphcloud plugin upgrade <name>` / `update` | Upgrade an installed plugin. |
+| `morphcloud plugin uninstall <name>` | Remove the plugin package. |
+| `morphcloud plugin register <name>` | Upsert a catalog entry from flags or `--manifest`. |
+| `morphcloud plugin publish <name> --wheel dist/pkg-version-py3-none-any.whl` | Upload a wheel to simple-index, then register the catalog entry. |
+| `morphcloud plugin enable/disable/delete <name>` | Manage catalog lifecycle. |
+| `morphcloud plugin doctor` | Show auth, index, catalog, and installed entry-point status. |
+
+Management commands accept `--visibility global|org` and `--organization-id`.
+Org-scoped entries require `--organization-id`; global entries must omit it.
+
+For local or preview simple-index services, set:
+
+```bash
+export MORPH_SIMPLE_INDEX_BASE_URL="http://127.0.0.1:8912"
+```
+
+The installer uses the authenticated simple-index URL as the primary package
+index for package-backed plugins and keeps PyPI as an extra index for public
+dependencies. Credentials are redacted from CLI output, including direct
+artifact URLs. Direct `artifact_url` installs are allowed only for URLs without
+embedded credentials, query strings, or fragments; use package-backed simple-index
+publishing for private or signed artifacts so secrets are not passed to pip as
+process arguments.
+
+For stricter private-package installs, set `MORPH_PLUGIN_DISABLE_EXTRA_INDEX=1`
+to omit the public extra index. To use a controlled mirror instead of PyPI, set
+`MORPH_PLUGIN_EXTRA_INDEX_URL`.
+
 ### Volumes
 
 Morph Volumes exposes an S3-compatible object store. Bucket lifecycle and object operations use your normal `MORPH_API_KEY`.
@@ -658,16 +720,49 @@ morphcloud user api-key create
 # Delete an API key
 morphcloud user api-key delete <api_key_id>
 
-# Get your SSH public key
-morphcloud user ssh-key get
+# List named SSH public keys (fingerprints, expiry, and status)
+morphcloud user ssh-key list
+
+# Add a user-owned public key; never provide the private key
+morphcloud user ssh-key add --name "Work laptop" --public-key-file ~/.ssh/id_ed25519.pub
+
+# Inspect and edit one managed key by its stable ID
+morphcloud user ssh-key get <ssh_key_id>
+morphcloud user ssh-key edit <ssh_key_id> --expires 2030-01-01T00:00:00Z
 
-# Set/update your SSH public key
+# Revoke only that key across your current organization memberships
+morphcloud user ssh-key revoke <ssh_key_id>
+
+# Legacy singular compatibility commands remain available
+morphcloud user ssh-key get
 morphcloud user ssh-key set --public-key "ssh-rsa AAAA..."
 
 # View usage (3-hour lookback by default; supports 30m, 3h, 7d, etc.)
 morphcloud user usage --interval 3h
 ```
 
+The same managed-key lifecycle is typed in the SDK, with async methods using the
+usual `a` prefix (`alist_ssh_keys`, `aadd_ssh_key`, and so on):
+
+```python
+from pathlib import Path
+
+from morphcloud.api import MorphCloudClient
+
+client = MorphCloudClient()
+key = client.user.add_ssh_key(
+    name="Work laptop",
+    public_key=Path("~/.ssh/id_ed25519.pub").expanduser().read_text().strip(),
+)
+key = client.user.get_managed_ssh_key(key.id)
+key = client.user.edit_ssh_key(key.id, name="Work laptop (2026)")
+client.user.revoke_ssh_key(key.id)
+```
+
+Managed account public keys are separate from Morph-generated instance
+credentials and browser terminal access. A managed key is owned by one user and
+authorizes direct SSH through that user's current organization memberships.
+
 ## Advanced Features
 
 ### Profiles

{morphcloud-0.1.111 → morphcloud-0.1.113}/README.md

@@ -185,6 +185,68 @@ morphcloud instance copy inst_123:/remote/file.log ./local_dir/
 morphcloud instance copy -r ./local_dir inst_123:/remote/dir
 ```
 
+### Plugins
+
+Plugins are Python packages that register extra `morphcloud` commands through
+the `morphcloud.cli_plugins` entry-point group. Catalog and package operations
+use your normal `MORPH_API_KEY`. A catalog entry can install from the private
+simple-index package name or from an explicit `artifact_url`.
+
+```bash
+# Inspect plugin configuration and installed commands
+morphcloud plugin doctor
+
+# List or inspect plugins visible to your organization
+morphcloud plugin list
+morphcloud plugin show intro
+
+# Validate install resolution without changing the environment
+morphcloud plugin install intro --dry-run
+
+# Install or update a plugin into the current Python environment
+morphcloud plugin install intro
+morphcloud plugin upgrade intro
+
+# Run the command exposed by the installed plugin
+morphcloud intro --help
+```
+
+Common commands:
+
+| Command | Purpose |
+| --- | --- |
+| `morphcloud plugin list [query]` | List visible enabled plugins. |
+| `morphcloud plugin search <query>` | Search visible plugins by name, package, artifact, or command. |
+| `morphcloud plugin show <name>` / `info` | Show one catalog entry. |
+| `morphcloud plugin install <name>` | Install into the active Python environment. |
+| `morphcloud plugin upgrade <name>` / `update` | Upgrade an installed plugin. |
+| `morphcloud plugin uninstall <name>` | Remove the plugin package. |
+| `morphcloud plugin register <name>` | Upsert a catalog entry from flags or `--manifest`. |
+| `morphcloud plugin publish <name> --wheel dist/pkg-version-py3-none-any.whl` | Upload a wheel to simple-index, then register the catalog entry. |
+| `morphcloud plugin enable/disable/delete <name>` | Manage catalog lifecycle. |
+| `morphcloud plugin doctor` | Show auth, index, catalog, and installed entry-point status. |
+
+Management commands accept `--visibility global|org` and `--organization-id`.
+Org-scoped entries require `--organization-id`; global entries must omit it.
+
+For local or preview simple-index services, set:
+
+```bash
+export MORPH_SIMPLE_INDEX_BASE_URL="http://127.0.0.1:8912"
+```
+
+The installer uses the authenticated simple-index URL as the primary package
+index for package-backed plugins and keeps PyPI as an extra index for public
+dependencies. Credentials are redacted from CLI output, including direct
+artifact URLs. Direct `artifact_url` installs are allowed only for URLs without
+embedded credentials, query strings, or fragments; use package-backed simple-index
+publishing for private or signed artifacts so secrets are not passed to pip as
+process arguments.
+
+For stricter private-package installs, set `MORPH_PLUGIN_DISABLE_EXTRA_INDEX=1`
+to omit the public extra index. To use a controlled mirror instead of PyPI, set
+`MORPH_PLUGIN_EXTRA_INDEX_URL`.
+
 ### Volumes
 
 Morph Volumes exposes an S3-compatible object store. Bucket lifecycle and object operations use your normal `MORPH_API_KEY`.
@@ -627,16 +689,49 @@ morphcloud user api-key create
 # Delete an API key
 morphcloud user api-key delete <api_key_id>
 
-# Get your SSH public key
-morphcloud user ssh-key get
+# List named SSH public keys (fingerprints, expiry, and status)
+morphcloud user ssh-key list
+
+# Add a user-owned public key; never provide the private key
+morphcloud user ssh-key add --name "Work laptop" --public-key-file ~/.ssh/id_ed25519.pub
+
+# Inspect and edit one managed key by its stable ID
+morphcloud user ssh-key get <ssh_key_id>
+morphcloud user ssh-key edit <ssh_key_id> --expires 2030-01-01T00:00:00Z
 
-# Set/update your SSH public key
+# Revoke only that key across your current organization memberships
+morphcloud user ssh-key revoke <ssh_key_id>
+
+# Legacy singular compatibility commands remain available
+morphcloud user ssh-key get
 morphcloud user ssh-key set --public-key "ssh-rsa AAAA..."
 
 # View usage (3-hour lookback by default; supports 30m, 3h, 7d, etc.)
 morphcloud user usage --interval 3h
 ```
 
+The same managed-key lifecycle is typed in the SDK, with async methods using the
+usual `a` prefix (`alist_ssh_keys`, `aadd_ssh_key`, and so on):
+
+```python
+from pathlib import Path
+
+from morphcloud.api import MorphCloudClient
+
+client = MorphCloudClient()
+key = client.user.add_ssh_key(
+    name="Work laptop",
+    public_key=Path("~/.ssh/id_ed25519.pub").expanduser().read_text().strip(),
+)
+key = client.user.get_managed_ssh_key(key.id)
+key = client.user.edit_ssh_key(key.id, name="Work laptop (2026)")
+client.user.revoke_ssh_key(key.id)
+```
+
+Managed account public keys are separate from Morph-generated instance
+credentials and browser terminal access. A managed key is owned by one user and
+authorizes direct SSH through that user's current organization memberships.
+
 ## Advanced Features
 
 ### Profiles

{morphcloud-0.1.111 → morphcloud-0.1.113}/morphcloud/api.py

@@ -13,7 +13,7 @@ from concurrent.futures import ThreadPoolExecutor, as_completed
 from functools import lru_cache
 
 import httpx
-from pydantic import BaseModel, Field, PrivateAttr
+from pydantic import BaseModel, Field, PrivateAttr, model_validator
 
 # Import Rich for fancy printing
 from rich.console import Console
@@ -24,6 +24,7 @@ from morphcloud.config import resolve_settings
 
 if typing.TYPE_CHECKING:
     from morphcloud.devbox.client import AsyncDevboxClient, DevboxClient
+    from morphcloud.simple_index.client import SimpleIndexClient
     from morphcloud.volumes.client import VolumesClient
 
 # Global console instance
@@ -51,10 +52,29 @@ class ApiError(Exception):
     def __init__(self, message: str, status_code: int, response_body: str):
         self.status_code = status_code
         self.response_body = response_body
+        self.error_code: typing.Optional[str] = None
+        self.detail: typing.Optional[str] = None
+        try:
+            payload = json.loads(response_body)
+            if isinstance(payload, dict):
+                error_code = payload.get("error_code")
+                detail = payload.get("detail")
+                if isinstance(error_code, str):
+                    self.error_code = error_code
+                if isinstance(detail, str):
+                    self.detail = detail
+        except (TypeError, ValueError):
+            pass
         super().__init__(
             f"{message}\nStatus Code: {status_code}\nResponse Body: {response_body}"
         )
 
+    def as_managed_ssh_key_error(self) -> typing.Optional["ManagedSSHKeyError"]:
+        """Return a typed managed-key error when the response uses that contract."""
+        if self.error_code is None or self.detail is None:
+            return None
+        return ManagedSSHKeyError(error_code=self.error_code, detail=self.detail)
+
 
 class ApiClient(httpx.Client):
     def raise_for_status(self, response: httpx.Response) -> None:
@@ -167,6 +187,7 @@ class MorphCloudClient:
         volumes_service_api_key: typing.Optional[str] = None,
         admin_base_url: typing.Optional[str] = None,
         db_base_url: typing.Optional[str] = None,
+        simple_index_base_url: typing.Optional[str] = None,
         ssh_hostname: typing.Optional[str] = None,
         ssh_port: typing.Optional[int] = None,
         devbox_base_url: typing.Optional[str] = None,
@@ -182,6 +203,7 @@ class MorphCloudClient:
                 "devbox_base_url": devbox_base_url,
                 "admin_base_url": admin_base_url,
                 "db_base_url": db_base_url,
+                "simple_index_base_url": simple_index_base_url,
                 "ssh_hostname": ssh_hostname,
                 "ssh_port": ssh_port,
             },
@@ -200,10 +222,12 @@ class MorphCloudClient:
         self.devbox_base_url = settings.devbox_base_url
         self.admin_base_url = settings.admin_base_url
         self.db_base_url = settings.db_base_url
+        self.simple_index_base_url = settings.simple_index_base_url
         self.profile = settings.profile
         self._devbox_client = None
         self._devbox_async_client = None
         self._volumes_client = None
+        self._simple_index_client = None
         if not self.api_key:
             raise ValueError(
                 "API key must be provided or set in MORPH_API_KEY environment variable"
@@ -254,9 +278,10 @@ class MorphCloudClient:
         )
 
         self._load_sdk_plugins()
-        # Ensure first-party devbox clients win even if an external plugin attempted to attach them.
+        # Ensure first-party clients win even if an external plugin attempted to attach them.
         self._devbox_client = None
         self._devbox_async_client = None
+        self._simple_index_client = None
 
     def _load_sdk_plugins(self):
         """Load SDK plugins from entry points."""
@@ -339,6 +364,18 @@ class MorphCloudClient:
     def volumes(self, value: "VolumesClient") -> None:
         self._volumes_client = value
 
+    @property
+    def simple_index(self) -> "SimpleIndexClient":
+        if self._simple_index_client is None:
+            from morphcloud.simple_index.client import SimpleIndexClient
+
+            self._simple_index_client = SimpleIndexClient(self)
+        return self._simple_index_client
+
+    @simple_index.setter
+    def simple_index(self, value: "SimpleIndexClient") -> None:
+        self._simple_index_client = value
+
 
 class BaseAPI:
     def __init__(self, client: MorphCloudClient):
@@ -423,28 +460,146 @@ class UserAPI(BaseAPI):
         await self._client._async_http_client.delete(f"/user/secret/{secret_name}")
 
     # ────────────────────────────────
-    # SSH Key
+    # Managed SSH public keys
+    # ────────────────────────────────
+    def list_ssh_keys(self) -> typing.List["ManagedSSHKey"]:
+        """List all managed SSH public keys owned by the authenticated user."""
+        response = self._client._http_client.get("/user/ssh-keys")
+        return ManagedSSHKeyList.model_validate(response.json()).data
+
+    async def alist_ssh_keys(self) -> typing.List["ManagedSSHKey"]:
+        """Asynchronously list all managed SSH public keys owned by the user."""
+        response = await self._client._async_http_client.get("/user/ssh-keys")
+        return ManagedSSHKeyList.model_validate(response.json()).data
+
+    def get_managed_ssh_key(self, ssh_key_id: str) -> "ManagedSSHKey":
+        """Get one managed SSH public key by its stable ID."""
+        response = self._client._http_client.get(f"/user/ssh-keys/{ssh_key_id}")
+        return ManagedSSHKey.model_validate(response.json())
+
+    async def aget_managed_ssh_key(self, ssh_key_id: str) -> "ManagedSSHKey":
+        """Asynchronously get one managed SSH public key by its stable ID."""
+        response = await self._client._async_http_client.get(
+            f"/user/ssh-keys/{ssh_key_id}"
+        )
+        return ManagedSSHKey.model_validate(response.json())
+
+    def add_ssh_key(
+        self,
+        name: str,
+        public_key: str,
+        expires: typing.Optional[int] = None,
+    ) -> "ManagedSSHKey":
+        """Add a named SSH public key, optionally expiring at Unix seconds."""
+        request_body = ManagedSSHKeyCreateRequest(
+            name=name, public_key=public_key, expires=expires
+        )
+        response = self._client._http_client.post(
+            "/user/ssh-keys", json=request_body.model_dump(exclude_none=True)
+        )
+        return ManagedSSHKey.model_validate(response.json())
+
+    async def aadd_ssh_key(
+        self,
+        name: str,
+        public_key: str,
+        expires: typing.Optional[int] = None,
+    ) -> "ManagedSSHKey":
+        """Asynchronously add a named SSH public key."""
+        request_body = ManagedSSHKeyCreateRequest(
+            name=name, public_key=public_key, expires=expires
+        )
+        response = await self._client._async_http_client.post(
+            "/user/ssh-keys", json=request_body.model_dump(exclude_none=True)
+        )
+        return ManagedSSHKey.model_validate(response.json())
+
+    def edit_ssh_key(
+        self,
+        ssh_key_id: str,
+        *,
+        name: typing.Optional[str] = None,
+        expires: typing.Optional[int] = None,
+        clear_expiry: bool = False,
+    ) -> "ManagedSSHKey":
+        """Edit a key's name or expiry without changing its public material.
+
+        Pass ``clear_expiry=True`` to send an explicit JSON null for ``expires``.
+        """
+        request_body = _managed_ssh_key_patch_request(
+            name=name, expires=expires, clear_expiry=clear_expiry
+        )
+        response = self._client._http_client.patch(
+            f"/user/ssh-keys/{ssh_key_id}",
+            json=request_body.model_dump(exclude_unset=True),
+        )
+        return ManagedSSHKey.model_validate(response.json())
+
+    async def aedit_ssh_key(
+        self,
+        ssh_key_id: str,
+        *,
+        name: typing.Optional[str] = None,
+        expires: typing.Optional[int] = None,
+        clear_expiry: bool = False,
+    ) -> "ManagedSSHKey":
+        """Asynchronously edit a key's name or expiry."""
+        request_body = _managed_ssh_key_patch_request(
+            name=name, expires=expires, clear_expiry=clear_expiry
+        )
+        response = await self._client._async_http_client.patch(
+            f"/user/ssh-keys/{ssh_key_id}",
+            json=request_body.model_dump(exclude_unset=True),
+        )
+        return ManagedSSHKey.model_validate(response.json())
+
+    def revoke_ssh_key(self, ssh_key_id: str) -> None:
+        """Permanently revoke one managed SSH public key by stable ID."""
+        self._client._http_client.delete(f"/user/ssh-keys/{ssh_key_id}")
+
+    async def arevoke_ssh_key(self, ssh_key_id: str) -> None:
+        """Asynchronously revoke one managed SSH public key by stable ID."""
+        await self._client._async_http_client.delete(f"/user/ssh-keys/{ssh_key_id}")
+
+    # ────────────────────────────────
+    # Legacy singular SSH key compatibility
     # ────────────────────────────────
     def get_ssh_key(self) -> "UserSSHKey":
+        """Get the legacy singular key through its compatibility endpoint."""
         response = self._client._http_client.get("/user/ssh-key")
         return UserSSHKey.model_validate(response.json())
 
     async def aget_ssh_key(self) -> "UserSSHKey":
+        """Asynchronously get the legacy singular compatibility key."""
         response = await self._client._async_http_client.get("/user/ssh-key")
         return UserSSHKey.model_validate(response.json())
 
     def update_ssh_key(self, public_key: str) -> "UserSSHKey":
+        """Set the legacy singular compatibility key.
+
+        New integrations should use :meth:`add_ssh_key`, then revoke the old key
+        only after verifying the replacement.
+        """
         response = self._client._http_client.put(
             "/user/ssh-key", json={"public_key": public_key}
         )
         return UserSSHKey.model_validate(response.json())
 
     async def aupdate_ssh_key(self, public_key: str) -> "UserSSHKey":
+        """Asynchronously set the legacy singular compatibility key."""
         response = await self._client._async_http_client.put(
             "/user/ssh-key", json={"public_key": public_key}
         )
         return UserSSHKey.model_validate(response.json())
 
+    def set_ssh_key(self, public_key: str) -> "UserSSHKey":
+        """Compatibility alias for :meth:`update_ssh_key`."""
+        return self.update_ssh_key(public_key)
+
+    async def aset_ssh_key(self, public_key: str) -> "UserSSHKey":
+        """Async compatibility alias for :meth:`aupdate_ssh_key`."""
+        return await self.aupdate_ssh_key(public_key)
+
     # ────────────────────────────────
     # Usage
     # ────────────────────────────────
@@ -517,10 +672,85 @@ class CreateSecretRequest(BaseModel):
 
 
 class UserSSHKey(BaseModel):
+    """Legacy singular user SSH-key response."""
+
     public_key: str
     created: int
 
 
+class ManagedSSHKeyStatus(StrEnum):
+    ACTIVE = "active"
+    EXPIRED = "expired"
+    REVOKED = "revoked"
+    MIGRATION_WARNING = "migration_warning"
+
+
+class ManagedSSHKey(BaseModel):
+    """A user-owned SSH public key accepted through current org memberships."""
+
+    object: typing.Literal["user_ssh_key"] = "user_ssh_key"
+    id: str
+    name: str
+    public_key: str
+    fingerprint: str
+    algorithm: str
+    created: int
+    updated: int
+    expires: typing.Optional[int] = None
+    last_used: typing.Optional[int] = None
+    revoked: typing.Optional[int] = None
+    status: ManagedSSHKeyStatus
+    migrated_from_legacy: bool = False
+    migration_warning: bool = False
+
+
+class ManagedSSHKeyList(BaseModel):
+    object: typing.Literal["list"] = "list"
+    data: typing.List[ManagedSSHKey]
+
+
+class ManagedSSHKeyCreateRequest(BaseModel):
+    name: str
+    public_key: str
+    expires: typing.Optional[int] = None
+
+
+class ManagedSSHKeyPatchRequest(BaseModel):
+    name: typing.Optional[str] = None
+    expires: typing.Optional[int] = None
+
+    @model_validator(mode="after")
+    def require_change(self) -> "ManagedSSHKeyPatchRequest":
+        if not self.model_fields_set:
+            raise ValueError("at least one of name or expires must be provided")
+        return self
+
+
+class ManagedSSHKeyError(BaseModel):
+    """Stable machine-readable error returned by managed-key endpoints."""
+
+    detail: str
+    error_code: str
+
+
+def _managed_ssh_key_patch_request(
+    *,
+    name: typing.Optional[str],
+    expires: typing.Optional[int],
+    clear_expiry: bool,
+) -> ManagedSSHKeyPatchRequest:
+    if clear_expiry and expires is not None:
+        raise ValueError("expires and clear_expiry cannot be used together")
+    values: typing.Dict[str, typing.Any] = {}
+    if name is not None:
+        values["name"] = name
+    if clear_expiry:
+        values["expires"] = None
+    elif expires is not None:
+        values["expires"] = expires
+    return ManagedSSHKeyPatchRequest(**values)
+
+
 class UserInstanceUsage(BaseModel):
     instance_cpu_time: int
     instance_memory_time: int